The Linux Foundation Projects
Skip to main content
search
All Posts By

Shane Coughlan

Shane Coughlan is an expert in communication, security and business development. His professional accomplishments include spearheading the licensing team that elevated Open Invention Network into the largest patent non-aggression community in history, establishing the leading professional network of Open Source legal experts and aligning stakeholders to launch both the first law journal and the first law book dedicated to Open Source. Shane has extensive knowledge of Open Source governance, internal process development, supply chain management and community building. His experience includes engagement with the enterprise, embedded, mobile and automotive industries.

Sep 18

Update on OpenChain ISO/IEC 18974 and the CRA

By News

Thanks in no small part to the advocacy of SZ Lin, OpenChain ISO/IEC 18974 has been officially referenced in the EU Cyber Resilience Act (CRA) harmonized standards discussion.

You will find OpenChain ISO/IEC 18974 cited in Slide 67 of the “CRA Standards Unlocked: Unlocking CRA Security Controls: preparation for UNE Event” from CEN CENELEC:

We are referenced alongside:
• ISO/IEC TR 5895:2022 – Cybersecurity – Multi-party coordinated vulnerability disclosure and handling
• ISO/IEC 30111:2019 – Information technology – Security techniques – Vulnerability handling processes
• ISO/IEC 29147:2018 – Information technology – Security techniques – Vulnerability disclosure

What this means:

The value of our security standard has been positively recognized by the parties bringing together the official CRA standards / requirements portfolio.

It provides a door to both continue and expand our collaboration in this space. The precise next steps will be determined in collaboration with our community and the governing board.

Sep 18

Welcoming the OpenChain Ambassador Program

By Featured, News

OpenChain Ambassadors are official advocates within the OpenChain Project helping build a more trusted supply chain. They are a point of contact for new participants, and can help connect the community with knowledge and solutions. They provide support, training, mentorship and guidance to help:

  • With OpenChain community through local meetups, events, and content
  • Foster strong community collaboration and relationships
  • Attract and welcome new community participants
  • Provide feedback to the OpenChain Governing Board about community programs and initiatives
  • Advocate OpenChain best practices and OpenChain initiatives around the world

We are delighted to welcome 21 initial ambassadors from around the world, and to provide an even greater community of support for everyone working on a more trusted supply chain.

To learn more about who is in the program, and how to contact them, via our official Ambassadors page.

Sep 16

Webinar: Introduction to the Cyber Resilience Act (CRA)

By community, legal, licensing, News, standards, Webinar

About This Webinar:

The European Union (EU) Cyber Resilience Act (CRA) is a new law that covers almost all “products with digital elements”, including software, released in the EU. Enforcement will begin in 2026, even on organizations who aren’t based in the EU. This presentation explains the scope and requirements of the CRA. This webinar was lead by David A. Wheeler, Director of Open Source Supply Chain Security at the Linux Foundation.

Check out our online training course diving deeper into this topic:
https://training.linuxfoundation.org/express-learning/understanding-the-eu-cyber-resilience-act-cra-lfel1001/

Watch the Webinar:

Review the Slides:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-09-12.

Sep 12

Webinar: Compliant containers with the OSADL Base Image

By legal, licensing, News, Webinar

About This Webinar:

While containers certainly simplify deploying software, fulfilling FOSS license obligations for containers is made difficult by their layered structure and the lack of compliance material in public repositories. Although every container is customized for its particular use and therefore comprises different software components, many are built on a base image that provides essential system components. It seems obvious to apply the Open Source principle of sharing development of non-differentiating technologies and services to license obligations of container base images. Therefore, OSADL offers the OSADL Base Images that are provided together with all required legal information and material needed to be distributed compliantly. A company may build their individual container images on top of the OSADL Docker Base Image and use the provided instructions to fulfill license obligations for the additional software to achieve license compliant container distribution. This presentation explained how the base images and in particular the license compliance material are created, list what flavors, versions and variants are available and show how they can be used to facilitate licensing of individual containers.

Project page: https://www.osadl.org/base-image

Docker Hub: https://hub.docker.com/r/osadl/

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-09-12.

Sep 12

The SBOM Study Group is now the SBOM Work Group

By News

What Is Happening?

The OpenChain SBOM Study Group has covered a lot of ground since it was formed in July 2024. After just over a year of work, and with a detailed examination of what is needed for quality cross-industry Software Bill of Materials, the Governing Board has voted to turn it into a Work Group.

The full details of Study Groups vs Work Groups can be found in our FAQ, but the short version is that a Study Group *thinks* about something, and a Work Group *works* on something.

The SBOM Study Group has prepared detailed conceptual information for a ‘SBOM Document Quality Guide’

The newly formed SBOM Work Group will turn this into a completed, formal OpenChain Guide. You can read about the future guide in detail from a special post we wrote on the subject.

How Can I Help?

The next step is to close all the comments on the draft document… or add your own! You will find it here:

Learn More About This Work Group:

Our SBOM Work Group brings all our various SBOM-related activities together and helps answer the question of “how do we use SBOMs in production, large-scale and complex supply chains?” Our original kick-off call has all the details.

Get Involved:

Everyone is welcome to be part of this work group! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/sbom

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/SBOM-sg

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here:
https://www.openchainproject.org/participate

Special Study Group > Work Group FAQ

Q: Does this mean links will change to the mailing list or GitHub repo?

A: No, nothing will change at this time.

Q: Does this mean leadership of the SBOM activity will change?

A: No, nothing will change at this time.

Q: Does this mean all the participants are even cooler than before?

A: Yes.

Sep 12

RECORDING: OpenChain Monthly Specification and Education Call (North America – Europe) – 2025-09-10

By News

We Discussed:

Quite a few things! Lead by Chris Wood (Chair, Specification Work Group) and Martin Yagi (Chair Education Work Group), the call covered the following agenda:

  • OpenChain Project News
  • Open Compliance Summit – Call for Papers
  • Specification Work Group – Some Questions for the Community
  • Education Work Group – Update on Status and Community Work Items
  • Any Other Business?

A reminder for those in Asia – while this edition of the monthly call is happening in the darkest hours of the night (01:30 in Japan!), we also have a monthly Europe / Asia call that works better for those in Eastern time zones. Check out the schedule for this and all our other meetings here:
https://openchainproject.org/participate

Watch the Recording:

Coming Next:

  • A ton of work pending on education, and a survey to be released for the spec. Expect a strong focus on looking at what we have accomplished, looking at feedback, and making it better.

Join Our Work:

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate

Sep 11

RECORDING: OpenChain AI Work Group – Asia Sync – 2025-09-11

By News

We held our regular OpenChain AI Work Group Asia Sync on the 11th of September. This meeting focused on reviewing comments around the AI Compliance Guide, which recently completed its public comment period and approval by the Governing Board.

The specific comments addressed were:

  1. https://github.com/OpenChain-Project/Reference-Material/issues/101
  2. https://github.com/OpenChain-Project/Reference-Material/issues/102
  3. https://github.com/OpenChain-Project/Reference-Material/issues/107
  4. https://github.com/OpenChain-Project/Reference-Material/issues/108
  5. https://github.com/OpenChain-Project/Reference-Material/issues/109

Watch the Recording:

Get Involved:

Everyone is welcome to be part of this activity! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list for the AI Work Group: https://lists.openchainproject.org/g/ai

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here: https://www.openchainproject.org/participate

Sep 11

RECORDING: OpenChain Telco Work Group – September – 2025-09-04

By News

This Meeting Had A Packed Agenda:

Watch the Recording:

Be part of this:

Everyone is welcome to be part of this study group! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/telco

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/Telco-WG

You are also welcome to participate in any of our other working groups around the world:

Sep 11

OpenChain in the CEN CENELEC CRA Discussion

By News

Thanks to the advocacy of SZ Lin, OpenChain ISO/IEC 18974 has been officially referenced in the EU Cyber Resilience Act (CRA) harmonized standards discussion.

You will find OpenChain ISO/IEC 18974 cited in Slide 67 of the “CRA Standards Unlocked: Unlocking CRA Security Controls: preparation for UNE Event” from CEN CENELEC:
https://www.cencenelec.eu/media/CEN-CENELEC/Events/Webinars/2025/2025-09-08_webinar_unlocking_cra_security_controls_preparation_for_une_event.pdf

We are referenced alongside:
• ISO/EC TR 5895:2022 – Cybersecurity – Multi-party coordinated vulnerability disclosure and handling
• SO/EC 30111:2019 – Information technology – Security techniques – Vulnerability handling processes
• ISO/IEC 29147:2018 – Information technology – Security techniques – Vulnerability disclosure

What this means:

The value of our security standard has been positively recognized by the parties bringing together the official CRA standards / requirements portfolio.

It provides a door to both continue and expand our collaboration in this space. The precise next steps will be determined in collaboration with our community and the governing board.

Ideas welcome!

Sep 09

OpenChain Webinar: Introduction to the Cyber Resilience Act (CRA) @ 17:00 EDT 2025-09-11

By News

Our next webinar will be entitled ‘Introduction to the Cyber Resilience Act (CRA)’ and will be delivered by our very own David A. Wheeler, Director of Open Source Supply Chain Security at the Linux Foundation. This will be a great starting point for people getting up-to-speed around the current situation.

About This Webinar:

The European Union (EU) Cyber Resilience Act (CRA) is a new law that covers almost all “products with digital elements”, including software, released in the EU. Enforcement will begin in 2026, even on organizations who aren’t based in the EU. This presentation will briefly explain the scope and requirements of the CRA. This webinar will be lead by David A. Wheeler, Director of Open Source Supply Chain Security at the Linux Foundation.

We start at 17:00 EDT 2025-09-11. All welcome, no registration needed.

Join here at the start time:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars